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REMARKS 

In view of the following remarks, Applicant respectfully requests 
reconsideration and allowance of the subject application. This amendment is 
believed to be fully responsive to all issues raised in the 12/02/2004 Office Action. 
In the Claims: 

Previously, claims 1 and 3 — 19 were pending- 
Claims 1, 4, 5, 7, II and 15 are currently amended. 
Claim 9, 10, 13 and 14 are canceled. 
No claims are added 

Claims 3, 6, 8, 12, 16, 18 and 19 are original. 

Accordingly, claims 1 and 3 — 8, 11 — 12, 15 — 19 are pending. 
Section 103 Rejection of the Claims 

Claims 1, 3 — 16 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over U.S. Patent No. 5,623 s 637, hereafter "Jones" in view of U.S. 
Patent No. 6,353,885, hereinafter "Herzi," The Applicants respectfully traverse 
the rejection and request that the rejection be reconsidered and withdrawn. 

Claims 1. 7 and 11 were amended to include material previously recited in 
claims 4, 9 and 10, respectively. Accordingly, the rejection of claims 1, 7 and 11 
will address the rejections of claims 4, 9 and 10, respectively. 

Claim 1 recites in a paragraph moved from claim 4, "wherein the memory 
device stores a public key and the smart card stores a corresponding private key 
and access to the user data in the memory device is enabled upon verification that 
the public key and the private key are associated." 

Claims 7 and 1 1 were similarly amended to recite elements formerly found 
in claims 9 and 1 0. 
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The rejection of claims 4, 9 and 10 (and therefore current claims 1, 7 and 
1 1 ) was based on two passages in the Jones reference, i.e. column 9 lines 22 — 37 
and column 9 lines 5 — 15. The cited passages in column 9 of Jones involves two 
paragraphs, lines 1—21 and 22—37. In the first paragraph, at column 9 lines 1 — 
21, Jones does not disclose public and/or private keys. Instead, Jones discloses a 
challenge-and-response system by which a user of a local computer having the 
PCMCIA card can gain access to capabilities of a remote computer. In particular, 
the access code (password) required to access the remote computer is stored in a 
password-protected PCMCIA card (col. 9, lines 6 — 10). Random numbers are 
used within the challenge-and-response exchange to protect the access code from 
interception by those monitoring the local and remote computers (col. 9, lines 
11—21). 

In the second paragraph, column 9 lines 22 — 37, Jones discloses how the 
local computer may request transmission of encrypted data, after the challenge- 
and-response sequence have proven the identity of the local / host (i.e. host of the 
PCMCIA card) computer to satisfaction of the remote computer. The data is 
encrypted according to a public key by the remote computer, and a private key is 
used by the host (of the PCMCIA card) to decrypt the data. Jones notes that more 
than one computer may send data using the public key to encrypt that data to be 
sent. 

The Patent Office takes the position that access to the remote computer by 
the host computer is provided after the public and private keys have been shown to 
be associated. (See rejection of claims 4, 9 and 10, middle of page 4 of document 
mailed 12/02/2004- Note however, that the Patent Office takes a conflicting 
position on page 8, line 7 — 9 of the document mailed 12/02/2004, when the Patent 
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Office indicated that Jones "does not disclose ... verifying compatibility of the 
public key and the private key.") 

However, what Jones really disclosed was that successful completion of a 
challenge-and-response exchange between the remote and host computers, and 
transmission of data from the remote computer (wherein the data was encoded by 
the public key) to the host computer (wherein the data was decoded by the private 
key). Accordingly, Jones discloses only conventional use of passwords (the 
challenge and response) along with conventional use of a public key to encrypt 
data and of a private key to decrypt the data. 

Therefore, Jones discloses the typical use of public/private key 
cryptography, wherein the public and private keys are used to encrypt and decrypt 
data 3 respectively. Jones fails to disclose a process wherein verification of the 
association between a public key and a private key is used to provide access to 
data. 

Accordingly, Jones does not disclose the recited elements of the claim, and 
therefore the Applicant respectfully requests that the rejection be removed from 
claims 1 » 7 and 1 1 . 

Claims 3. 4 and 8 depend from claims 1 and 7, and are allowable by virtue 
of this dependence, as well as for reasons associated with the elements recited by 
each claim. Accordingly, the Applicant respectfully requests that these claims be 
allowed to issue. 

Claim 5 recites in part "authenticate the public key stored on the memory 
device using the private key.'* The argument with respect to claims 1, 7 and 11, 
above, is incorporated herein by reference. The Patent Office argues that Jones 
discloses the above-recited passage, and points to Jones' column 9, lines 24 —42. 
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As discussed with respect to claims 1, 7 and 11, Jones discloses use of a public 
key to encrypt (Jones, column 9, lines 28 — 29) and uses the private key to decrypt 
(column 9, lines 29 — 31). This is the conventional use of public/private key 
inscription. 

In contrast, claim 5 recites the use of public and private keys in an 
authentication roll, as opposed to the convention use of such keys disclosed by 
Jones, i.e. data encryption. Accordingly, element recited by claim 5 are not shown 

8 by Jones, and the Applicant respectfully requests that the rejection of claim 5 be 

9 removed. 

Claim 6 depends from claim 5, and is allowable by virtue of this 
dependence, as well as for reasons associated with the elements recited in claim 6* 

12 Accordingly, the Applicant respectfully requests that claim 6 be allowed to issue. 

13 Claim 12 depends from claim 11, and is allowable by virtue of this 
H dependence, as well as for reasons associated with the elements recited by each 
is claim. Accordingly, the Applicant respectfully requests that claim 12 be allowed 

16 to issue. 

17 Claim IS was amended, as was claim 1, to include elements from claim 4. 
is Accordingly, claim 15 is allowable for substantially the same reasons as claim 1, 

and the arguments presented above are incorporated herein by reference. 

Claim 16 depends from claim 15, and is allowable by virtue of this 

21 dependence, as well as for reasons associated with the elements recited by claim 

22 16. Accordingly, the Applicant respectfully requests that claim 16 be allowed to 

23 issue. 

24 Claim 17 is rejected under 35 U.S.C. §103(a) as being unpatentable over 

25 Jones in view of U.S. Patent No. 5,987,138, hereinafter "Gilbert " The Applicants 
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respectfully traverse the rejection and request that the rejection be reconsidered 
and withdrawn. 

Claim 17 recites, in part, 

"verifying compatibility of the public key and the private key; and 

"allowing, in response to the verified compatibility, access to the user data 
on the portable memory device." 

The Gilbert reference discloses an identification and/or signature process 
whereby a claimant is able to convince a verifier that the claimant is who the 
claimant represents to be. This is a one-way process, in that the claimant does not 
verify who the verifier is, but wherein the verifier does verify who the claimant is. 
Accordingly, the issue addressed by Gilbert is not the compatibility of the public 
and private key; instead, Gilbert addresses validity of the identity of the claimant. 

Gilbert discloses a series of steps wherein questions and answers are passed 
between the claimant and the verifier, ultimately providing a level of assurance to 
the verifier of the claimant's identity. However, in none of the questions does 
Gilbert verify the compatibility of the public key and the private key; instead, 
Gilbert verifies the identity of one party to the satisfaction of the other party. 

The Patent Office suggests that the verifier sends random numbers, and that 
these numbers are used in the process that verifies the claimant's identity. 
However, the Applicant's claim does not recite random numbers or verifying an 
identity of one party, but instead recites the compatibility of two keys. 

Accordingly, Gilbert discloses a method by which one party (the claimant) 
can verify its identity to the satisfaction of the other party (the verifier). This is 
not the same as "verifying compatibility of the public key and the private key," 
which involves verification that each key is compatible with (as opposed to known 
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to) the other. Accordingly, the Applicant respectfully requests that the rejection to 
claim 17 be removed, and that claim 17 be allowed to issue. 

Claims 18 and 19 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Jones and Herzi, in view of U.S. 6,266,416, hereinafter 
"Sigbjornsen." The Applicants respectfully traverse the rejection and request that 
the rejection be reconsidered and withdrawn. 

Claims 18 and 19 recite "authenticating the public key using the private 
key," and "authenticating, at the smart card, the device-resident key using the 
card-resident key," respectively. 

Column 9, lines 1 — 21 of Jones discloses a challenge-and-response 
exchange wherein a password on the PCMCIA card is used to access designated 
functions on the remote computer. Thus, a conventional use of passwords is 
disclosed. 

Column 9, lines 22 — 37 of Jones discloses encrypted data from the remote 
computer using the public key on the host computer and the private key on the 
smartcard. Thus, conventional use of public and private key cryptography is 
disclosed for encoding data for secure transmission. 

The Patent Office cited column 9 of Jones for allegedly disclosing card key 
and device key authentication, as well as public key and private key association. 
Since this rejection is similar to that of claim 1, that response is incorporated 
herein, and the below comments are also to be added to that response. 

In particular, the Patent Office suggests that lines 5 — 37 disclose 
verification of the association of the keys. However, the first paragraph of column 
9 actually discloses a challenge-and-response password procedure wherein the 
host of the PCMCIA card gains access to functionality on the remote computer, 
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and the second paragraph of column 9 discloses use of public and private key 
cryptography to transfer data from the remote computer to the host computer. 

Sigbjomsen, column 9 lines 44 — 49, discloses the use of public and private 
key cryptography to decrypt sections of code that have been encrypted to thwart 
use without permission. Thus (as seen in Fig. 2 of Sigbjomsen) a segment of the 
software is encrypted. (By encrypting only part of the software, decryption 
overhead is reduced.) Lines 44—49 describe how 44 — 57 describe how the 
decryption is performed. 

Thus, neither reference discloses, "authenticating the public key using the 
private key." Accordingly, the Applicant respectfully requests that the rejection to 
claims 18 and 19 be removed. 
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Conclusion 

Claims 1 and 3 — 8, 11 — 12, 15—19 are in believed to be in condition for 
allowance. Applicant respectfully requests reconsideration and prompt issuance of 
the present application. Should any issue remain that prevents immediate issuance 
of the application, the Examiner is encouraged to contact the undersigned attorney 
to discuss the unresolved issue. 



Respectfully Submitted, 
Lee & Hayes, PI 

421 W/TW<?*id8 Avenue, Suite 500 



Dated: 



Spokane,^ 



By: 




David S. ThompsoV 
Reg. No. 37,954 
Attorney for Applicant 

LEE & HAYES PLLC 
Suite 500 

421 W. Riverside Avenue 
Spokane, Washington 99201 
Telephone: 509-324-9256 x235 
Facsimile: (509) 323-8979 
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